body-parser
2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed
2.4.0 is the newest release of 2.x.
In short
1 breaking1 removed1 new1 faster2 fixed5 changed7 internal
- breaking
Update package.json engines field to reflect minimum supported node version
- removed
Remove unpipe package and use native unpipe method
Security
2 advisories affect 2.1.0; 2.4.0 fixes them
- Highbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyGHSA-27r3-jxmh-p828 · 23 Oct 2026Fixed in 2.4.0
- Lowbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-v422-hmwv-36x6 · 20 Jul 2026Fixed in 2.3.0
Release note
What's Changed
- breaking
Update package.json engines field to reflect minimum supported node version
Remove brotli support check
- removed
Remove unpipe package and use native unpipe method
Remove unused devDependency
methodsRemove devDependency
safe-bufferUse the node require cache instead of custom caching
Remove obsolete dependency
destroycleanup: Remove obsolete test env file
Refactor decompression stream creation to remove code duplication
Add caret for body-parser dependencies
Release v2.1.0